CVE-2022-36033 : Security Advisory and Response

A vulnerability has been discovered in jsoup, a Java HTML parser, which may not properly sanitize Cross-Site Scripting (XSS) attempts if

SafeList.preserveRelativeLinks

is enabled.

Understanding CVE-2022-36033

jsoup is primarily designed for HTML parsing and editing to ensure cross-site scripting (XSS) safety. However, due to a specific configuration, XSS attacks can potentially bypass the sanitization process.

What is CVE-2022-36033?

CVE-2022-36033 refers to a security flaw in jsoup that could allow malicious users to execute XSS attacks by abusing the HTML sanitization mechanism within the parser.

The Impact of CVE-2022-36033

The impact of this vulnerability is significant as it exposes systems using vulnerable versions of jsoup to XSS attacks, potentially leading to unauthorized access and data theft.

Technical Details of CVE-2022-36033

This section delves into the specific technical aspects of the CVE, including the vulnerability description, affected systems, and exploitation mechanisms.

Vulnerability Description

jsoup versions prior to 1.15.3 are affected by this vulnerability, allowing crafted

javascript:

URL expressions to evade proper sanitization, paving the way for XSS attacks.

Affected Systems and Versions

Vendor: jhy Product: jsoup Versions Affected: < 1.15.3

Exploitation Mechanism

If the

SafeList.preserveRelativeLinks

option is enabled, crafted

javascript:

URLs can bypass proper sanitization, potentially leading to XSS exploits.

Mitigation and Prevention

To address CVE-2022-36033 and enhance system security, immediate mitigative steps and long-term prevention strategies are crucial.

Immediate Steps to Take

Upgrade jsoup to version 1.15.3 or newer to patch the vulnerability.
Consider disabling

SafeList.preserveRelativeLinks

as a temporary workaround.

Long-Term Security Practices

Implement an appropriate Content Security Policy (CSP) to mitigate XSS risks proactively.

Patching and Updates

Regularly update jsoup to the latest version to ensure the inclusion of security patches and enhancements.